Hi, I'm relatively new to syslog-ng, but have dug in enough to see that there's an option in 2.0.9 (possibly earlier as well) to skip message parsing that throws off the "unparseable log message" errors. In src/logmsg.c, there's apparently a flag that can be set to skip parsing. (See line 140). I have one particular message source that I'd like to skip parsing on. What I haven't been able to determine is how to configure syslog- ng.conf with the flag that would skip the parsing of the log message. Can anyone help out on this? Thanks, Clay -- Killersoft.com
On Sun, 2008-06-01 at 21:45 -0700, Clay Loveless wrote:
Hi,
I'm relatively new to syslog-ng, but have dug in enough to see that there's an option in 2.0.9 (possibly earlier as well) to skip message parsing that throws off the "unparseable log message" errors.
In src/logmsg.c, there's apparently a flag that can be set to skip parsing. (See line 140).
I have one particular message source that I'd like to skip parsing on. What I haven't been able to determine is how to configure syslog- ng.conf with the flag that would skip the parsing of the log message.
Can anyone help out on this?
flags(no-parse) for the given source. -- Bazsi
On Jun 2, 2008, at 12:38 AM, Balazs Scheidler wrote:
flags(no-parse) for the given source.
Thank you! One more question regarding source options -- I'm using a pipe source, and would like to make it optional, however the optional(yes) parameter seems to be considered a syntax error. Here's the entry: source test { pipe("/tmp/test_fifo" optional(yes) flags(no-parse) log_msg_size(1024)); }; I'm I doing this incorrectly? Thank you, Clay -- Killersoft.com
On Mon, 2008-06-02 at 15:39 -0700, Clay Loveless wrote:
On Jun 2, 2008, at 12:38 AM, Balazs Scheidler wrote:
flags(no-parse) for the given source.
Thank you! One more question regarding source options -- I'm using a pipe source, and would like to make it optional, however the optional(yes) parameter seems to be considered a syntax error.
Here's the entry:
source test { pipe("/tmp/test_fifo" optional(yes) flags(no-parse) log_msg_size(1024)); };
I'm I doing this incorrectly?
syslog-ng does not currently support optional pipes. The reason is that optional files are implemented using the same infrastructure that allows to tail files. (e.g. checking the file size every second) As pipes don't need to be followed, optional is not supported for them. It is not a big issue to implement, but it has not been done yet. -- Bazsi
participants (2)
-
Balazs Scheidler
-
Clay Loveless